Mid Florida Dermatology & Plastic Surgery Data Breach Affects 85K Patients
Data breaches have been announced by Mid Florida Dermatology & Plastic Surgery, Kannarr Eye Care in Kansas, and Indiana University Health Affiliated Covered Entity.
Mid Florida Dermatology & Plastic Surgery
Mid Florida Dermatology & Plastic Surgery, a medical group with 33 locations in central Florida, has notified the HHS’ Office for Civil Rights about a data breach affecting 85,585 individuals. According to a September 10, 2026, notice on the medical group’s website, unusual activity was identified within its computer systems on March 30, 2026. The forensic investigation determined that an unauthorized third party had access to its network from March 26, 2026, to March 30, 2026, during which time files containing patient data may have been viewed or acquired.
The data review determined that the information potentially accessed or obtained included names, addresses, dates of birth, passport numbers, Social Security numbers, driver’s license numbers, Medicare numbers, other government identification numbers, financial account numbers, financial account access information, health insurance information, and medical information. The types of information involved varied from individual to individual. Mid Florida Dermatology & Plastic Surgery said it is reviewing its security policies and procedures and is taking steps to reduce the risk of similar incidents in the future.
Kannarr Eye Care
Kannarr Eye Care, an optometry practice based in Pittsburg, Kansas, has identified unauthorized access to its computer systems. The incident was identified on March 30, 2026, and the forensic investigation determined that an unauthorized third party accessed or acquired files containing patients’ personal and protected health information.
A review of the affected data was completed on August 17, 2026, confirming that names, Social Security numbers, and health insurance information were involved. Kannarr Eye Care has enhanced its security measures, implemented additional technical safeguards, and strengthened its policies and procedures related to data privacy and security to reduce the risk of similar incidents in the future. Notification letters were mailed to the affected individuals on September 17, 2026. The data breach was reported to the HHS’ Office for Civil Rights as affecting 14,003 individuals.
Indiana University Health, Affiliated Covered Entity
Indiana University Health Affiliated Covered Entity, has disclosed a security incident that has affected 2,080 individuals. The incident involved one of its vendors, AME Group. AME Group provides information technology services for an isolated IU Health legacy system. IU Health learned on August 4, 2026, that a previously unknown security vulnerability was susceptible to exploitation. Steps were immediately taken to verify the security of its systems, and while it was established that its core systems and electronic medical records were unaffected, a review of AME’s external vendor-managed system confirmed that there had been unauthorized access to limited imaging center information related to patients in Southern Indiana.
The information involved varied from individual to individual and may have included names, birth dates, health plan ID numbers, and limited treatment information related to the imaging center. The affected individuals were notified on September 29, 2026.
